CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16916Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): add ETH calldata digest translated string

This commit only adds a new user-facing text label, 'ERC-8213 digest', used when a Trezor device displays Ethereum transaction details. There is no code that processes transaction data, cryptography, or user authorization. It is a translat…

a4097f69by Roman Zeyde+44−46 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/delizia): warning title should be red if `danger=true`

This is a visual-only bug fix for the Trezor hardware wallet's Delizia user interface. When a warning screen is marked as dangerous, the title text was supposed to appear red, but it was only showing a danger icon. The fix adds the missing…

UI styling fix onlyNo logic, crypto, or authorization changesNo input parsing or memory handling changes
f3b6bb5fby Roman Zeyde+787−7872 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/delizia): enable external menus for `confirm_properties()`

This commit changes a Trezor firmware UI function so that a previously ignored 'external menu' flag is now actually used. When the flag is set, the confirmation screen uses an externally supplied menu instead of the built-in one. The chang…

Parameter previously ignored (`_external_menu`) is now activeAffects confirmation-screen menu construction in hardware wallet firmwareSwitches between internal and external menu source based on caller input
c1d3ca4eby Roman Zeyde+6−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/eckhart): enable external menus for `confirm_properties()`

This commit is a routine UI feature addition for the upcoming Trezor Safe 7 (Eckhart layout). It lets the device show a simplified external menu during certain confirmation screens, and currently rejects combinations that aren't yet suppor…

db045b86by Roman Zeyde+26−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix broken race handler in test_funding_external_wallet_corners

This is a one-line fix to a flaky automated test. The test was supposed to tolerate a harmless race condition where a peer disconnects during connection, but the assertion was checking the wrong part of the error object, so the test failed…

a87aa28aby Ken Sedgwick+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

release: CHANGELOG and version bumps for v26.06.6

This commit is purely a release housekeeping change: it updates version strings from v26.06.2 to v26.06.6 and adds a CHANGELOG entry for the new release. The CHANGELOG mentions two fixes that were already made in earlier commits (a Python …

d6bce325by daywalker90+24−1210 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add chunkify param to TronSignTx

This commit adds a new optional 'chunkify' setting to Tron transaction signing on Trezor hardware wallets. When enabled, addresses are shown on the device screen in small groups of characters (chunks of 4) instead of one long string, makin…

UI display parameter change for address confirmationDefault value flipped from chunkify=True to chunkify=False in Tron layout helpersNew optional protobuf field added to TronSignTx
f956a430by obrusvit+425−29316 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

wallet_db: register onion_keys converter

This commit fixes a bug in Electrum's Lightning wallet database handling. After a wallet restart, a specific type of encryption key used in Lightning payments was being loaded as a text string instead of raw bytes. This mismatch could caus…

Type confusion between str and bytes in cryptographic key handlingLightning payment error path affected after wallet restartMissing data converter in wallet database layer
5b2eb060by f321x+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core/ethereum): add EIP-7702 test vectors

This commit only adds a new test data file containing example inputs and expected outputs for Ethereum's EIP-7702 authorization signing feature. It does not change any production firmware code, so it cannot introduce a security vulnerabili…

bf9ca3baby PrisionMike+128−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/ethereum): make `ConfirmDataFn` a class

This commit is a straightforward internal code cleanup in the Ethereum transaction signing flow. It turns a callback-creating helper function into a class and moves where that object is created. There is no change to user-visible behavior,…

f560b6f0by Roman Zeyde+48−552 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix flaky test_simple_close_dust_output_omitted mempool race

This commit fixes a flaky automated test, not a security bug in the actual Core Lightning software. The test sometimes failed because it took a snapshot of Bitcoin's memory pool and then tried to fetch each transaction, but one transaction…

406fc7a4by Ken Sedgwick+16−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(trezorlib, ethereum): trezorctl accepts dev signed contract descriptors

This commit adds a new debugging option to the Trezor command-line tool (trezorctl) that lets advanced users supply their own ERC-7730 contract descriptors for Ethereum transactions. These descriptors tell the hardware wallet how to displa…

New host-supplied data path into transaction signing flowUser-controlled descriptor blob can influence on-device display of contract callsNo visible signature/integrity enforcement in the added Python code
f0a46479by PrisionMike+109−212 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →